AsusSystemDiagnosis[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

AsusSystemDiagnosis.exe
Size

771KB
MD5

8417086c10b42d43719db4d2105f9661
SHA1

cfb8776f4530fcdbf980adb7b569a572bc46297b
SHA256

2085ab26563c291f7488a733f1882dd88fc57f4bae0f25e77936a9331714060f
SHA512

0ac75381e3d8f9337a873079871470f57ad31e26da3263256a0e9d4ec8f665d2ef8b0c6db917ee3777ed084ca0f523afa2305c55450e79484a92f2f213912f6d
SSDEEP

12288:+u99JordSoXukEB+ozqHAT3orvLv0cXBocdFhQyyoLq3:39JorukE0igT0cx5h2oLQ

Score

N/A

Malware Config

Signatures

Files

AsusSystemDiagnosis.exe
.exe windows x64

014ab2177656c3e433ef5f700fdc3e8a

Code Sign

07:20:7b:3a:1a:cb:44:e4:dc:39:eb:d3:89:a9:6d:65
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

04-05-2021 00:00

Not After

08-05-2024 23:59

Subject

SERIALNUMBER=23638777,CN=ASUSTeK COMPUTER INC.,OU=SYS BG-PC BU-SW RD Ctr,O=ASUSTeK COMPUTER INC.,L=Beitou District,ST=Taipei City,C=TW,1.3.6.1.4.1.311.60.2.1.3=#13025457,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18-04-2012 12:00

Not After

18-04-2027 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29-03-2022 00:00

Not After

14-03-2033 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

09-06-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:dc:34:1a:52:0f:bb:cf:3d:8c:00:00:00:00:00:dc
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

10-03-2022 19:58

Not After

08-03-2023 19:58

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18-04-2012 23:48

Not After

18-04-2027 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

68:cd:d6:2b:df:02:c9:30:2b:54:19:82:9a:05:c8:1e:26:fe:31:bd:04:35:eb:9e:87:51:fc:8b:ce:60:ab:b8
Signer

Actual PE Digest

68:cd:d6:2b:df:02:c9:30:2b:54:19:82:9a:05:c8:1e:26:fe:31:bd:04:35:eb:9e:87:51:fc:8b:ce:60:ab:b8

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

29-09-2022 18:51
Valid: false

68:cd:d6:2b:df:02:c9:30:2b:54:19:82:9a:05:c8:1e:26:fe:31:bd:04:35:eb:9e:87:51:fc:8b:ce:60:ab:b8
Signer

Actual PE Digest

68:cd:d6:2b:df:02:c9:30:2b:54:19:82:9a:05:c8:1e:26:fe:31:bd:04:35:eb:9e:87:51:fc:8b:ce:60:ab:b8

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

SERIALNUMBER=23638777,CN=ASUSTeK COMPUTER INC.,OU=SYS BG-PC BU-SW RD Ctr,O=ASUSTeK COMPUTER INC.,L=Beitou District,ST=Taipei City,C=TW,1.3.6.1.4.1.311.60.2.1.3=#13025457,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

04-08-2022 09:45
Valid: true

Chain 1

SERIALNUMBER=23638777,CN=ASUSTeK COMPUTER INC.,OU=SYS BG-PC BU-SW RD Ctr,O=ASUSTeK COMPUTER INC.,L=Beitou District,ST=Taipei City,C=TW,1.3.6.1.4.1.311.60.2.1.3=#13025457,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

OutputDebugStringA
GetProcessWorkingSetSize
VirtualFree
GetCurrentProcess
VirtualAlloc
VirtualUnlock
VirtualLock
SetProcessWorkingSetSize
WTSGetActiveConsoleSessionId
GetModuleFileNameA
FileTimeToSystemTime
GetCurrentProcessId
WritePrivateProfileStringW
GetPrivateProfileIntW
LoadLibraryW
HeapAlloc
GetProcessHeap
WriteConsoleW
SetEndOfFile
ReadConsoleW
SetFilePointerEx
FindClose
FindNextFileW
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
CreateDirectoryW
CreateProcessW
PeekNamedPipe
CreatePipe
TerminateProcess
WriteFile
ReadFile
GetStartupInfoW
OpenProcess
K32GetModuleFileNameExW
WideCharToMultiByte
FreeLibrary
GlobalMemoryStatusEx
LocalFree
GetProcAddress
ResetEvent
CreateThread
GetNativeSystemInfo
LoadLibraryA
SetEvent
Sleep
GetPrivateProfileStringW
GetExitCodeThread
MultiByteToWideChar
CreateEventW
GetPrivateProfileSectionNamesW
LocalAlloc
WaitForSingleObject
GetPrivateProfileSectionW
GetDiskFreeSpaceExW
GetLastError
CloseHandle
CreateFileW
FlushFileBuffers
HeapSize
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
HeapReAlloc
GetConsoleMode
GetConsoleCP
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
GetExitCodeProcess
GetTimeZoneInformation
GetFileType
HeapFree
GetCommandLineW
GetCommandLineA
GetStdHandle
GetModuleFileNameW
GetModuleHandleExW
ExitProcess
FindFirstFileExW
GetFileAttributesExW
DuplicateHandle
LoadLibraryExW
RaiseException
RtlPcToFileHeader
RtlUnwindEx
DeviceIoControl

user32

EnumDisplayDevicesW
wsprintfW

advapi32

SetSecurityDescriptorDacl
ReadEventLogW
CreateServiceA
StartServiceCtrlDispatcherA
CloseServiceHandle
SetServiceStatus
OpenSCManagerA
RegisterServiceCtrlHandlerExA
DeleteService
ControlService
StartServiceA
ChangeServiceConfig2A
OpenServiceA
RegOpenKeyExW
RegQueryValueExW
EqualSid
SetTokenInformation
OpenProcessToken
CreateProcessAsUserW
DuplicateTokenEx
GetTokenInformation
EventWriteTransfer
EventRegister
EventSetInformation
AllocateAndInitializeSid
SetEntriesInAclW
FreeSid
CloseEventLog
RegCloseKey
RegQueryValueExA
InitializeSecurityDescriptor
RegOpenKeyExA
OpenEventLogW

ole32

CoCreateInstance
CoUninitialize
CoInitialize
StringFromGUID2
CoSetProxyBlanket

oleaut32

VariantInit
SysFreeString
SysAllocString
VariantClear
SafeArrayGetElement

setupapi

CM_Get_Device_ID_ListW
CM_Open_DevNode_Key
CM_Get_Parent
CM_Get_Device_IDW
SetupDiRemoveDevice
CM_Disable_DevNode
SetupDiBuildDriverInfoList
SetupDiGetDeviceRegistryPropertyW
SetupDiGetDevicePropertyW
SetupDiEnumDeviceInfo
CM_Get_Device_ID_List_SizeA
CM_Locate_DevNodeW
CM_Get_Device_Interface_List_SizeW
SetupDiEnumDriverInfoA
SetupDiGetDeviceInstanceIdW
CM_Get_Device_Interface_ListW
SetupDiDestroyDeviceInfoList
SetupDiGetClassDevsA
CM_Enable_DevNode

bthprops.cpl

BluetoothFindRadioClose
BluetoothFindNextDevice
BluetoothFindNextRadio
BluetoothGetRadioInfo
BluetoothFindDeviceClose
BluetoothFindFirstDevice
BluetoothFindFirstRadio

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

rpcrt4

RpcServerListen
RpcEpUnregister
RpcServerInqBindings
RpcMgmtStopServerListening
UuidToStringW
RpcStringFreeW
NdrServerCall2
RpcServerInqCallAttributesA
RpcBindingVectorFree
RpcServerUseProtseqEpW
RpcEpRegisterA
RpcServerRegisterIf3
RpcServerUnregisterIf
NdrServerCallAll

api-ms-win-security-base-l1-2-2

DeriveCapabilitySidsFromName

iphlpapi

GetAdaptersInfo

userenv

CreateEnvironmentBlock
DestroyEnvironmentBlock

api-ms-win-devices-config-l1-1-1

CM_Get_DevNode_PropertyW

ext-ms-win-networking-wlanapi-l1-1-0

WlanEnumInterfaces
WlanQueryInterface
WlanCloseHandle
WlanFreeMemory
WlanOpenHandle
WlanGetAvailableNetworkList

wlanapi

WlanSetInterface
WlanGetInterfaceCapability
WlanScan
WlanGetNetworkBssList

api-ms-win-core-synch-l1-1-0

InitializeCriticalSectionAndSpinCount
WaitForSingleObjectEx

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry

api-ms-win-core-errorhandling-l1-1-0

SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

TlsGetValue
TlsAlloc
SwitchToThread
TlsSetValue
TlsFree
GetCurrentThreadId

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-localization-l1-2-0

LCMapStringW
GetCPInfo
GetLocaleInfoW

api-ms-win-core-string-l1-1-0

GetStringTypeW
CompareStringW

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

wtsapi32

WTSQueryUserToken

Sections

.text
Size: 508KB - Virtual size: 507KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 206KB - Virtual size: 205KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

014ab2177656c3e433ef5f700fdc3e8a

Code Sign

07:20:7b:3a:1a:cb:44:e4:dc:39:eb:d3:89:a9:6d:65Certificate

Extended Key Usages

Key Usages

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5cCertificate

Extended Key Usages

Key Usages

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9dCertificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0Certificate

Extended Key Usages

Key Usages

33:00:00:00:dc:34:1a:52:0f:bb:cf:3d:8c:00:00:00:00:00:dcCertificate

Extended Key Usages

61:0b:aa:c1:00:00:00:00:00:09Certificate

Key Usages

68:cd:d6:2b:df:02:c9:30:2b:54:19:82:9a:05:c8:1e:26:fe:31:bd:04:35:eb:9e:87:51:fc:8b:ce:60:ab:b8Signer

Signature Validations

Verification

29-09-2022 18:51 Valid: false

68:cd:d6:2b:df:02:c9:30:2b:54:19:82:9a:05:c8:1e:26:fe:31:bd:04:35:eb:9e:87:51:fc:8b:ce:60:ab:b8Signer

Signature Validations

Verification

04-08-2022 09:45 Valid: true

Chain 1

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

ole32

oleaut32

setupapi

bthprops.cpl

version

rpcrt4

api-ms-win-security-base-l1-2-2

iphlpapi

userenv

api-ms-win-devices-config-l1-1-1

ext-ms-win-networking-wlanapi-l1-1-0

wlanapi

api-ms-win-core-synch-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-debug-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-util-l1-1-0

wtsapi32

Sections

.text Size: 508KB - Virtual size: 507KB

.rdata Size: 206KB - Virtual size: 205KB

.data Size: 8KB - Virtual size: 19KB

.pdata Size: 22KB - Virtual size: 22KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 5KB - Virtual size: 4KB

07:20:7b:3a:1a:cb:44:e4:dc:39:eb:d3:89:a9:6d:65
Certificate

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0
Certificate

33:00:00:00:dc:34:1a:52:0f:bb:cf:3d:8c:00:00:00:00:00:dc
Certificate

61:0b:aa:c1:00:00:00:00:00:09
Certificate

68:cd:d6:2b:df:02:c9:30:2b:54:19:82:9a:05:c8:1e:26:fe:31:bd:04:35:eb:9e:87:51:fc:8b:ce:60:ab:b8
Signer

29-09-2022 18:51
Valid: false

68:cd:d6:2b:df:02:c9:30:2b:54:19:82:9a:05:c8:1e:26:fe:31:bd:04:35:eb:9e:87:51:fc:8b:ce:60:ab:b8
Signer

04-08-2022 09:45
Valid: true

.text
Size: 508KB - Virtual size: 507KB

.rdata
Size: 206KB - Virtual size: 205KB

.data
Size: 8KB - Virtual size: 19KB

.pdata
Size: 22KB - Virtual size: 22KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 5KB - Virtual size: 4KB